...
Apache Tomcat CVE score Critical and High
| date | CVE | description | versions | Risk for Delft-FEWS | JIRA | upgrade strategy | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Sep 2026 | CVE-2026-76183 |
| Tomcat versions:
| FEWS-35642 | Update Tomcat to version 11.0.26 | |||||||||||||
| Apr 2025 | CVE-2024-38286 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process. |
| 2022.01 - 2024.02 |
| False positive, updated in 2025.01 only | ||||||||||||
| Apr 2025 | CVE-2025-24813 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: If all of the following were true, a malicious user was able to perform remote code execution: |
| 2022.01 - 2024.02 |
| False positive, updated in 2025.01 only | ||||||||||||
| Feb 2025 | CVE-2024-38286 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process. Tomcat embedded which is part of the FEWS installation is normally not setup for https and should be used only for testing purposes within the protection of a local network so that it should never be exposed to the public internet. |
| 2022.01 - 2022.02 |
| False positive | ||||||||||||
| December 2024 | CVE-2024-50379 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This applies only to Tomcat server or tomcat embedded if writing files to the server is enabled, which is considered a highly unlikely scenario that would be the responsibility of the Tomcat server administrator. In the Tomcat embedded instance used by FEWS this is not the case. This is considered a false positive. |
| 2021.02 - 2024.02 |
| False positive | ||||||||||||
| November 2023 | Tomcat did not correctly parse HTTP trailer headers. A specially crafted trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. |
| Upgrade to latest version of Apache Tomcat. Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10. | |||||||||||||||
| October 2023 | When recycling various internal objects, including the request and the response, prior to re-use by the next request/response, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. |
| Upgrade to latest version of Apache Tomcat. Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10. | |||||||||||||||
| October 2023 | Tomcat's HTTP/2 implementation was vulnerable to the rapid reset attack. The denial of service typically manifested as an OutOfMemoryError. |
| Upgrade to latest version of Apache Tomcat. Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10. | |||||||||||||||
| October 2023 | Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. |
| Upgrade to latest version of Apache Tomcat. Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10. | |||||||||||||||
| June 2023 | CVE-2023-34981 | A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak. |
| None, we do not use AJP proxy | Upgrade to latest version of Apache Tomcat. Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10. | |||||||||||||
| May 2023 | CVE-2022-28079 | The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur. |
| Upgrade to latest version of Apache Tomcat. Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10. |